Privacy Policy

1. Who we are and what this policy covers

LeadSeed is a product operated by Performlytics Inc. (“Performlytics,” “we,” “us,” “our”), a company based in Ontario, Canada. This Privacy Policy explains what personal information we collect through the LeadSeed website at myleadseed.com and the LeadSeed application (together, the “Service”), how we use it, who we share it with, and the rights and choices you have. LeadSeed is a business tool; we collect information from the business owners and team members who use it. When your website sends us a lead, we also handle your own customers’ lead details on your behalf, only as described in section 7. Where we need your consent, we ask for it at the moment we collect the information.

2. Information we collect

Information you give us. When you use LeadSeed we collect: your email address (to create your account and sign you in); your business name and website address; any notes or edits you make to your tracking plan; and, if your site isn’t yet eligible for LeadSeed, an email address you choose to give us to join our waitlist. If you sign up for our alpha, we collect your email address, your phone number, whether you have run performance marketing before, and (optionally) your website address, together with the page or campaign that brought you to us, so we can confirm your place on the list and contact you about the alpha by email or phone.

Information you give us for your ads. If you join our Google Ads pilot, we also collect the details your ads are built from: your business name and a short version of it for your ads; your phone number (it appears in your ads so customers can call you); your business address and how far around it your ads should show (Google uses the address as the centre of that area, and it is not shown in your ads); the page on your website your ads link to; your opening hours, or that you’re open 24/7; the services you offer; whether you’re licensed and insured, your licence number, and your confirmation that the licence details are true, with the date you confirmed it; facts you want your ads to be able to mention, such as years in business, same-day service, free estimates, financing and its terms, a guarantee in your own words, and brands you’re an authorised dealer for; your monthly ad budget; any promotion you’re running; searches you don’t want your ads to show for; your approval of the campaign plan, with who approved it, when, and the version of this policy and our Terms in effect at the time; and any change requests you send us. If you book a call with us, our scheduling provider collects your name and email address, and we receive those together with your business name, your website and what the call is about.

Information we collect automatically. When you use the Service we collect a limited amount of technical information: a one-way hashed version of your IP address (used only to prevent abuse and rate-limit requests — we do not retain your raw IP address in our application records); basic device and browser information; and product-analytics events describing how you move through the app (for example, which setup step you’re on and whether it succeeded). These analytics events are linked to a random identifier rather than your name or email; once you sign in, that identifier is your account’s ID.

Information from accounts you connect. If you choose to connect a Google account, we receive certain information from Google as described in the next section.

3. Google user data: what we access and why

When you connect your Google account, you grant LeadSeed permission to specific Google services so we can set up your tracking for you and, if you join our Google Ads pilot, run Google Search ads in your own Google Ads account. We request the narrowest set of permissions needed to do that:

• Read the list of your analytics and tag-management accounts — so you can choose which one we should set things up in.
• Create and manage analytics resources (an analytics property, a web data stream, and conversion events) on your behalf.
• Read your Google Analytics data — specifically, we read the real-time report to confirm that a test event we send actually reaches your analytics, so we can verify your tracking is working end to end.
• Create, edit, and publish tag-management resources (a container, its tags and triggers, and a published version) on your behalf. If an older Google Ads tag in a Tag Manager container you already have would count your leads twice, we may also pause that one tag and publish the change; we change nothing else in that container.
• Create files that LeadSeed itself creates in your Google Drive — used to set up your lead spreadsheet, add each new lead to it, and check which leads you’ve marked as converted. This permission is limited to files we create; we cannot see your other Drive files.
• Upload conversion events to your own Google Ads account — when a lead you mark as won becomes a paying customer, we send that conversion to your Google Ads account so your ad campaigns can optimize for real customers, not just clicks. We send only the ad-click codes Google attaches to an ad click (such as gclid, wbraid or gbraid), which don’t contain your customers’ names or contact details, together with a conversion value and timestamp. We never send your customers’ names, email addresses, or phone numbers, and we only send conversions you have chosen to track.

• Set up and run Google Ads in your own Google Ads account — with your permission we list the Google Ads accounts your login can manage (so you can pick yours instead of copying an account number), create a single “Converted lead” conversion action in your own account so the conversions above have somewhere to land, and switch on automatic tagging if it’s off — the Google setting that labels clicks from your ads so conversions can be matched back to them.

  If you join our Google Ads pilot, we also use this permission — and only after you have approved a campaign plan — to create and manage one Google Search campaign in your own account: its daily budget, its ad groups, the searches it shows for and the searches it blocks, its ads and their call, link, text and promotion extras, its location, language and schedule settings, and two conversion goals for it to aim for: calls from your ads, and leads from your website. So those two can be counted, we switch them on in your account’s conversion goals; we never switch off or remove a goal you already use, and switching ours on can also make your other campaigns count those leads if they follow your account’s default goals. Every campaign we create has “LS-” at the start of its name and carries a “LeadSeed” label, and it is created paused. Nothing is switched on until you have approved it and billing is set up in your Google Ads account — either as Google reports it to us, or, when Google does not report it, as you tell us.

  To run it safely and report to you, we read: your account’s name, currency, time zone, status and whether it’s a test account; the list of people with access to your account and their access levels, only to find your own access level (we don’t keep the list); whether billing is set up — its status and dates only; your existing conversion actions and conversion goals, so we add to them instead of replacing them; keyword ideas, search volumes and cost estimates from Google’s planning tools; the current settings of the campaign objects with the names we plan to use, so we never create a duplicate or touch something that isn’t ours; the policy review status of our own ads; and the cost, click, impression, keyword, search-term and conversion figures for the campaign we created. We never change your billing or payment settings, and we never see your card or payment details. We never change, pause, or remove campaigns, ads, keywords, audiences, budgets, or bids that LeadSeed did not create, and we don’t read their performance.

• Access you choose to give our ads specialist — during the Google Ads pilot we ask you to add our ads specialist’s own Google account as a user on your Google Ads account, so they can make hands-on adjustments. You grant that access in Google’s own settings, not through LeadSeed’s connection, and you can remove it at any time in your Google Ads account’s access settings. With it, our specialist can see your Google Ads account in Google’s own tools; they use it only to look after the campaign LeadSeed created. When they apply one of the suggestions in your weekly report, we record that it was applied.
• Your basic Google identity (your email address and a Google account identifier) — only to label the connection in the app and to recognize if you later reconnect with a different account.

4. How we use your information

We use the information we collect to: provide, operate, and maintain the Service (set up and keep your tracking working); authenticate you and keep your account secure through passwordless sign-in; communicate with you about your account, including service and security notices; understand and improve how the Service is used through privacy-preserving product analytics; detect, prevent, and address abuse, fraud, and technical problems; and comply with our legal obligations and enforce our Terms.

5. How we use AI

To tell you quickly whether LeadSeed can help and to pre-fill your setup, we send the public content of the website address you enter — such as the page title and visible page text — to a third-party AI content-classification provider that detects your industry and website platform. We only send content that is already publicly available on your site. For this check we send only public website content, never data from your Google accounts, and this content is not used by us or the provider to train generalized AI models.

If you join our Google Ads pilot, we also use an AI provider to draft the wording of your ads. For each group of ads we send it only what is needed to write them: your business name and its short version, your city, the kind of job the ads are for, up to five of the searches they target (these can include keyword ideas from Google’s planning tools), and simple facts you gave us — whether you’re open 24/7, whether you offer same-day service, whether you’re licensed with a licence number on file, whether you’re insured, how many years you’ve been in business, whether you offer free estimates or financing, your guarantee in your own words, and brands you’re an authorised dealer for. If our specialist asks for a redraft, their notes go with it. We never send your phone number, your email address, your street address, or any cost, click, billing or account data from your Google accounts, and we strip anything that looks like a phone number or an email address out of the text first. Every draft is checked automatically against Google’s ad rules and read by a person before you see it, and we keep a copy of what we sent and what came back so we can review the quality of the wording. Our AI provider is Google, through its paid Gemini API; under its terms it doesn’t use what we send to train its models. This content is not used by us or the provider to train generalized AI models.

After you send your ad details, our AI may read your answers, your own notes and the text of your website, and ask you up to three short, optional questions whose answers would improve your ads. Before anything is sent, we remove contact details, links, addresses, your business name and your city from your notes and website text.

When we check your tracking setup, our automatic checks decide every finding. AI only rewrites those findings in plain English; it can’t add, remove or change one.

Our Growth checkup uses AI to write its report from the facts our checks found about your public website, how you show up in Google search, and nearby competitors. We get the search and competitor data from a search-data provider.

6. How we share information

We do not sell your personal information. We share it only as described here:

• Service providers (sub-processors). We rely on a small number of vetted providers to run the Service. They may process your information only on our instructions and only to provide their service to us. By category, they are: a cloud hosting and content-delivery provider; a database and authentication provider; a product-analytics platform; an error-monitoring service; a transactional-email provider; an AI provider for website classification and ad wording; a scheduling provider for calls you book with us; a search-data provider for our Growth checkup; a bot-protection service for our Growth checkup; and a background-job engine.
• Accounts you connect. We act within the Google (and, in future, other) accounts you connect, at your direction, to provide the Service. In the Google Ads pilot, that includes creating and running the campaign you approve in your own Google Ads account. Google bills you directly for your ads.
• Websites you connect. When you connect a WordPress website to LeadSeed, the administrators of that website can see the email address you sign in with and the business name on your account, on the LeadSeed plugin’s settings page, so they know which LeadSeed account the website is linked to.
• Our ads specialist. During the Google Ads pilot, an ads specialist who works for LeadSeed reviews your ad details, your campaign plan, the Google Ads account details we read, and your weekly reports and the suggestions in them, and receives email alerts about your campaign. They use this information only to run your campaign, under our instructions and this policy.
• Legal and safety. We may disclose information if required by law, regulation, or legal process, or to protect the rights, property, safety, or security of our users, the public, or LeadSeed.
• Business transfers. If we’re involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction; we’ll notify you, and we’ll require any buyer to protect your information as this policy describes.

7. Your customers' lead data

What happens to a lead. When someone fills in a form on your website, the LeadSeed plugin sends us what they typed, such as their name, email, phone number and message, along with the page they were on and the ad click that brought them. We use it for one thing: adding it as a new row in the lead spreadsheet we set up in your own Google account, using the Google connection you gave us. We do this on your behalf. Once the row is in your spreadsheet, we don’t keep the lead’s name, email, phone number or message, with two exceptions: the new-lead alert, which our email provider keeps for up to 90 days (you can turn the details off), and the reference number, ad-click codes, page and any deal value you mark, which we keep so we can report a sale once. We never use them for anything else, never sell them, and never use them to train AI. If your spreadsheet can’t be reached for a moment, the lead waits on your own website and is sent again; it isn’t stored with us.

New-lead alerts. When a lead arrives, we email you their name, phone number, email address and where they came from, so you can get back to them quickly. That email passes through our email provider on its way to you, and our email provider keeps a copy of each alert for up to 90 days. You can turn the details off in your settings, and the alert will then say only that a new lead came in. Each alert has a “Got the job?” button: tap it to tell us that lead became a paying customer, and we’ll mark it in your spreadsheet.

Marking a paying customer. About every 15 minutes we check your spreadsheet for leads you’ve marked as converted. For this we read only the columns we need: our reference number, the “Got the job?” box, the deal value and the ad click identifiers. We never read the name, email, phone number or message columns for this. When you mark a lead, we keep its reference number, ad click identifiers, deal value, the date and the page it came from, so we can report the sale to Google Ads or Meta once, and only once.

The leads are yours. The spreadsheet belongs to you. You can edit, export or delete it at any time, and it stays yours if you stop using LeadSeed. You’re responsible for telling visitors to your website how their information is used and for getting any consent the law requires, for example in your own website’s privacy notice. If someone asks you to delete their details, delete their row in your spreadsheet. We hold no copy of it to delete.

To check that your tracking is still working, about once a day we count how many leads arrived in the spreadsheet we set up for you. We read only two columns to do it — the time a lead arrived and a reference number we generate ourselves — never a name, email, phone number, or message, and we keep only the resulting count, not the rows behind it. We compare that count with the number of form submissions Google Analytics recorded for the same period, which is how we can tell you if your tracking has quietly stopped counting.

If you run ads with us, your weekly report counts calls and forms as Google Ads records them. These are counts from Google, not your customers’ names or contact details, and the report uses only Google’s numbers — it doesn’t mix in counts from the lead spreadsheet we set up for you. The report also shows the searches people typed before your ad appeared, as Google reports them; we leave out any search that looks like a phone number or an email address.

8. Cookies and similar technologies

We set our own cookies only. Most are needed for LeadSeed to work: keeping you signed in, completing a Google or WordPress connection safely, and remembering a website check or setup in progress. One holds a random analytics ID so we can see how people move through LeadSeed; it isn’t your name or email, and once you sign in it’s linked to your account ID. Our scheduling provider’s booking widget sets its own cookies when it loads: on your tracking report it loads with the page; on the website check it loads only if you choose to book a call. We don’t currently use advertising cookies or pixels, and we don’t use cookies to track you across other websites. If we add Meta’s pixel to our public pages to measure our own advertising, it will load only after you click Accept on our cookie banner, a browser Global Privacy Control signal will count as No, and we’ll update this section first. You can clear cookies in your browser at any time.

9. How long we keep information

We keep your account information for as long as your account is active. If you run a website analysis but don’t create an account, we retain that analysis — and any alpha sign-up details or waitlist email you gave us — only for as long as needed for the purpose you provided it, after which it is deleted. When you delete your account, your account data is deleted, and that deletion cascades to your stored connection tokens and the operational records tied to your account. We may retain limited information for longer where necessary to comply with the law, resolve disputes, or enforce our agreements. Abuse-prevention records, such as hashed rate-limit data, are short-lived and pruned automatically. You can request deletion at any time (see “Your rights and choices”).

If you join our Google Ads pilot, we keep the details you gave us for your ads, your campaign plans and your approvals and change requests, the keyword research and estimates behind each plan, the list of what we created in your Google Ads account, and a record of the emails we sent you about your campaign, for as long as your account is active — together they are the record of what you approved and what we did in your account. They are stored in our database alongside the rest of your account data. We keep your weekly reports, and the suggestions in them, for as long as your account is active, so we can show you how your ads changed over time. The emailed link to a report stops working 90 days after the first day of the week that report covers; after that, ask us and we can send you a copy, and the copy we emailed you stays in your inbox. The copies of AI ad-wording inputs and drafts we keep for quality review are kept while your account is active. When your LeadSeed account is deleted, all of this is deleted with it. The campaigns in your Google Ads account belong to you and are not deleted — and deleting your LeadSeed account does not pause them. Pause or remove them yourself in Google Ads, which takes effect right away, or ask us in writing before you ask us to delete your account and we will pause them within one working day.

10. How we protect your information

We take reasonable and appropriate measures to protect your information, including: encrypting connection tokens at rest using strong, authenticated encryption, and never logging them in plain text; storing IP addresses only as a one-way hash; isolating each customer’s data and restricting access to the server processes that need it; scrubbing sensitive values from our logs and error reports; and encrypting data in transit (HTTPS). If a security breach affects your information, we’ll tell you, and the regulator, as the law requires. No method of transmission or storage is completely secure, but we review our safeguards as the Service grows.

11. Your rights and choices

Depending on where you live — for example, in Canada or some US states — you may have some or all of these rights: to access the personal information we hold about you; to correct it; to delete it; to receive a copy in a portable format; to restrict or object to certain processing; and to withdraw consent. We do not sell your personal information or use it for cross-context behavioral advertising. To exercise any right, email privacy@myleadseed.com; you won’t be treated differently for exercising your rights. We verify a request by replying to the email address on your account, and we respond within 30 days. If you disagree with our answer, reply and ask us to review it again. You can also complain to the Office of the Privacy Commissioner of Canada. You can disconnect Google at any time from your Google Account’s security settings (under third-party access) or from within the app, and we will delete the stored connection token.

12. International data transfers

We’re based in Canada. Our service providers process information in Canada, the United States and other countries, under terms that require them to protect it. Information held in another country can be accessed by that country’s courts and authorities under its laws.

13. Children's privacy

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

14. Third-party sites and services

The Service links to and integrates with third-party services, including the platforms you choose to connect. Their handling of your information is governed by their own privacy policies, not this one.

When you open our Growth checkup on your own device (for example, from a QR code on your phone), we use Cloudflare Turnstile to check that you’re a person and not an automated script. Turnstile looks at technical information from your browser and device to make that check, without showing you a puzzle. Cloudflare’s handling of that information is described in its Turnstile Privacy Addendum.

15. Changes to this policy

We may update this policy as the Service evolves or as the law changes. We’ll post the updated policy here with a new “Last updated” date, and for material changes that affect how we handle your data, we’ll provide prominent notice and, where required, ask for your consent.

16. Contact us

Performlytics Inc., Runnymead Crescent, Oakville, ON L6M 1C5, the company behind LeadSeed, is the controller of your personal information. For privacy questions or requests, email privacy@myleadseed.com. We’re based in Ontario, Canada.